The vulnerability arises from insufficient file type validation, allowing an authenticated user to upload any file to the Nokia MantaRay Network Management system. This flaw exposes the system to the insertion of malicious files, which may later be executed by the application or used as a foothold for further exploitation. The weakness aligns with improper file type validation (CWE‑434).

The affected product is Nokia MantaRay NM, a network management system used in telecom infrastructures. No specific firmware or software version is mentioned, so any currently deployed instance of MantaRay NM could be susceptible. Administrators should verify the product version against Nokia’s release notes or the advisory to determine if their installation is affected.

The CVSS score of 7.8 categorizes the issue as high severity, while the EPSS score of less than 1% and the absence of listing in the CISA KEV catalog indicate a relatively low likelihood of widespread exploitation at present. However, the vulnerability requires a valid authenticated session, meaning that attackers would need legitimate access to the NM interface. Once authenticated, they could use the upload feature to place malicious content on the device, potentially compromising confidentiality or integrity of the system.